diff --git a/.env.example b/.env.example
index 82e1340..64c24e5 100644
--- a/.env.example
+++ b/.env.example
@@ -36,4 +36,4 @@ SMTP_PASSWORD=
 SMTP_FROM=noreply@example.com
 
 # URL used in email links (e.g., password reset links)
-APP_BASE_URL=http://localhost:3000
+APP_BASE_URL=http://localhost:8080
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db88eec..da484e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
 
       - name: Install migrate
         run: |
-          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.17.0/migrate.linux-amd64.tar.gz | tar xvz
+          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.19.1/migrate.linux-amd64.tar.gz | tar xvz
           sudo mv migrate /usr/local/bin/
 
       - name: Run migrations
@@ -56,7 +56,7 @@ jobs:
         env:
           DATABASE_URL: postgres://uniauth:uniauth@localhost:5432/uniauth_test?sslmode=disable
           REDIS_URL: redis://localhost:6379/0
-          JWT_SECRET: test-secret-key-for-ci
+          JWT_SECRET: test-secret-key-for-ci-32-charsx
         run: go test ./... -race -timeout 120s
 
   lint:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3090ca1..abdae83 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -6,7 +6,7 @@ Thank you for your interest in contributing! This document explains how to get s
 
 ### Prerequisites
 
-- Go 1.24+
+- Go 1.24.7+
 - Docker & Docker Compose
 - `make`
 
@@ -100,7 +100,7 @@ func TestListSessions(t *testing.T) { ... }
 ## Running Tests
 
 ```bash
-# Unit + integration tests (requires Docker for testcontainers)
+# Unit + integration tests
 make test
 
 # Short tests only (no DB)
diff --git a/Dockerfile b/Dockerfile
index 3562ac2..99e1e51 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # ─── Build stage ─────────────────────────────────────────────────────────────
-FROM golang:1.24-alpine AS builder
+FROM golang:1.24.7-alpine AS builder
 
 RUN apk add --no-cache git ca-certificates
 
diff --git a/Makefile b/Makefile
index 5bf8723..3b068f5 100644
--- a/Makefile
+++ b/Makefile
@@ -74,7 +74,7 @@ docker-down:
 # ─── Dev setup ───────────────────────────────────────────────────────────────
 
 setup: ## Install development tools
-	go install github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+	go install github.com/golang-migrate/migrate/v4/cmd/migrate@v4.19.1
 	go install golang.org/x/tools/cmd/goimports@latest
 	go install github.com/swaggo/swag/cmd/swag@latest
 
diff --git a/README.md b/README.md
index 83e9e08..77fe11e 100644
--- a/README.md
+++ b/README.md
@@ -206,7 +206,7 @@ docker run -d \
 
 | Layer | Technology |
 |---|---|
-| Language | Go 1.24 |
+| Language | Go 1.24.7 |
 | HTTP Router | [chi](https://github.com/go-chi/chi) |
 | Database | PostgreSQL 16 (pgx/v5) |
 | Cache | Redis 7 |
diff --git a/pkg/token/jwt_test.go b/pkg/token/jwt_test.go
index 7e8d123..f7d8ffb 100644
--- a/pkg/token/jwt_test.go
+++ b/pkg/token/jwt_test.go
@@ -242,12 +242,23 @@ func TestMaker_VerifyAccessToken_TamperedToken(t *testing.T) {
 	orgID := uuid.New()
 
 	tokenStr, _, _ := maker.CreateAccessToken(userID, orgID)
-	// Flip the last character to tamper with the signature
-	tampered := tokenStr[:len(tokenStr)-1] + "X"
-	if tampered[len(tampered)-1] == tokenStr[len(tokenStr)-1] {
-		tampered = tokenStr[:len(tokenStr)-1] + "Y"
+	parts := strings.Split(tokenStr, ".")
+	if len(parts) != 3 {
+		t.Fatalf("expected JWT with 3 segments, got %d", len(parts))
 	}
 
+	signature := parts[2]
+	if signature == "" {
+		t.Fatal("expected non-empty JWT signature")
+	}
+
+	// Mutate the first signature character so the decoded signature bytes always change.
+	tamperedSignature := "A" + signature[1:]
+	if tamperedSignature[0] == signature[0] {
+		tamperedSignature = "B" + signature[1:]
+	}
+	tampered := strings.Join([]string{parts[0], parts[1], tamperedSignature}, ".")
+
 	_, err := maker.VerifyAccessToken(tampered)
 	if err == nil {
 		t.Fatal("expected error for tampered token, got nil")